# Use of Unmaintained Third Party Components (CWE-1104)

The product relies on third-party components that are no longer being maintained by the original developer or by the open source community.

**Stack:** JavaScript

- Prevalence: Media 2 lenguajes cubiertos
- Impact: Medio Se recomienda revisión
- Prevention: Documentada 5 ejemplos de corrección

**OWASP:** Security Misconfiguration (A05:2021-Security Misconfiguration) - #5

## Description

Without ongoing maintenance, newly discovered vulnerabilities in these components will not be patched. This creates an increasing risk as time passes and vulnerabilities are discovered.

## Prevention

Estrategias de prevención para Use of Unmaintained Third Party basadas en 2 reglas de detección de Shoulder.

### JavaScript

Update .nvmrc to a supported Node.js LTS version (22 or 20)

Align Node.js versions across .nvmrc, Dockerfile, and package.json to the same LTS version

## Warning Signs

- [MEDIUM] .nvmrc specifies ...
- [MEDIUM] Node.js versions are inconsistent across configuration files. Check the docker-image-outdated finding for the latest rec
- [MEDIUM] inconsistent Node

## Consequences

- Ejecutar código no autorizado
- Leer datos de la aplicación
- DoS

## Mitigations

- Audita y actualiza regularmente las dependencias de terceros
- Establece un proceso para monitorizar las vulnerabilidades de los componentes
- Ten un plan para reemplazar los componentes sin mantenimiento

## Detection

- Total rules: 5
- Languages: dockerfile, javascript

## Rules by Language

### Javascript (2 rules)

- **.nvmrc Specifies Outdated Node.js Version** [MEDIUM]: Detects .nvmrc files specifying outdated or end-of-life (EOL) Node.js versions.

The .nvmrc file is used by Node Version Manager (nvm) to automatically switch
to the correct Node.js version for a project. When this file specifies an
outdated version, developers may be running insecure or incompatible Node.js
versions in their development environments.

Node.js version lifecycle (as of 2025):
- Node 14.x: EOL April 2023
- Node 16.x: EOL September 2023
- Node 18.x: EOL April 2025
- Node 20.x: Main
  - Remediation: Update .nvmrc to a supported Node.js LTS version (20.x or 22.x).
- **Node.js Version Mismatch Between Configuration Files** [MEDIUM]: Detects inconsistent Node.js versions across project configuration files.

When .nvmrc specifies one Node.js version but Dockerfile uses a different
version, it causes environment drift:

- "Works on my machine" bugs (code works locally but fails in production)
- Security inconsistencies (development may use patched version while
  production uses vulnerable version)
- Dependency incompatibilities (npm packages may behave differently)
- Debugging difficulties (hard to reproduce production issues
  - Remediation: Align ALL configuration files to use the SAME Node.js version.

IMPORTANT: Check the docker-image-outdated finding for the LATEST version.
The API provides real-time version recommendations.

After determining the latest version from docker-image-outdated, update:
  - Dockerfile: FROM node:<version>-alpine
  - .nvmrc: <version>
  - package.json engines.node: ">=<version>.0.0"

NEVER downgrade. Always use the NEWER version shown in docker-image-outdated.